X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=bin%2Fblhc;h=b6889ae3ca51162e50d5c93f321d18235dc46a0a;hb=21f2f49049ef599e6d7116c815e5974b2fcdd505;hp=c4fac96d01db2bdc7c21e8bed2a4755aa8e649b1;hpb=018466d7ddd9c78f1e1efbafbb7be2f969e1bbd1;p=blhc%2Fblhc.git

diff --git a/bin/blhc b/bin/blhc
index c4fac96..b6889ae 100755
--- a/bin/blhc
+++ b/bin/blhc
@@ -2,7 +2,7 @@
 
 # Build log hardening check, checks build logs for missing hardening flags.
 
-# Copyright (C) 2012-2021  Simon Ruderich
+# Copyright (C) 2012-2022  Simon Ruderich
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -243,7 +243,7 @@ my @def_cxxflags = (
 # @def_cxxflags_* is the same as @def_cflags_*.
 my @def_cppflags = ();
 my @def_cppflags_fortify = (
-    '-D_FORTIFY_SOURCE=2', # must be first, see cppflags_fortify_broken()
+    '-D_FORTIFY_SOURCE=[23]', # must be first, see cppflags_fortify_broken()
     # If you add another flag fix hack below (search for "Hack to fix") and
     # $def_cppflags_fortify[0].
 );
@@ -299,6 +299,7 @@ my %flag_renames = (
     '-O(?:2|3)'                    => '-O2',
     '-Wformat(?:=2)?'              => '-Wformat',
     '--param[= ]ssp-buffer-size=4' => '--param=ssp-buffer-size=4',
+    '-D_FORTIFY_SOURCE=[23]'       => '-D_FORTIFY_SOURCE=2',
     '-Wl,(?:-z,)?relro'            => '-Wl,-z,relro',
     '-Wl,(?:-z,)?now'              => '-Wl,-z,now',
 );
@@ -690,7 +691,7 @@ if ($option_help) {
 }
 if ($option_version) {
     print <<"EOF";
-blhc $VERSION  Copyright (C) 2012-2021  Simon Ruderich
+blhc $VERSION  Copyright (C) 2012-2022  Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -1080,6 +1081,8 @@ foreach my $file (@ARGV) {
                                \s.+\s
                                -I\S+/mkspecs/[a-z]+-g\++(?:-64)?
                                \s}x;
+            # nvcc is not a regular C compiler
+            next if $line =~ m{^\S+/bin/nvcc\s};
             # Ignore false positives when the line contains only CC=gcc but no
             # other gcc command.
             if ($line =~ /(.*)CC=$cc_regex_full(.*)/o) {
@@ -1150,7 +1153,7 @@ foreach my $file (@ARGV) {
 
     # Option or auto detected.
     if ($arch) {
-        # The following was partially copied from dpkg-dev 1.20.5
+        # The following was partially copied from dpkg-dev 1.21.13
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, _add_build_flags()),
         # copyright Raphaël Hertzog <hertzog@debian.org>, Guillem Jover
         # <guillem@debian.org>, Kees Cook <kees@debian.org>, Canonical, Ltd.
@@ -1821,7 +1824,7 @@ E<lt>jari.aalto@cante.netE<gt> for their valuable input and suggestions.
 
 =head1 LICENSE AND COPYRIGHT
 
-Copyright (C) 2012-2020 by Simon Ruderich
+Copyright (C) 2012-2022 by Simon Ruderich
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by